diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7a62c2a8..c627e5be 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,7 +27,7 @@ jobs:
     needs: [skip-check]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0 # otherwise, ci will failed to push refs
 
diff --git a/.github/workflows/gh-pages.yaml b/.github/workflows/gh-pages.yaml
index 45a62c97..efbea2de 100644
--- a/.github/workflows/gh-pages.yaml
+++ b/.github/workflows/gh-pages.yaml
@@ -21,7 +21,7 @@ jobs:
     steps:
       # <Not provided for brevity>
       # At a minimum this job should upload artifacts using actions/upload-pages-artifact
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0 # otherwise, ci will failed to push refs
 
@@ -37,6 +37,6 @@ jobs:
           touch packages/storybook/storybook-static/.nojekyll
 
       - name: Deploy 🚀
-        uses: JamesIves/github-pages-deploy-action@v4
+        uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f # v4
         with:
           folder: packages/storybook/storybook-static
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index de549066..55e17e73 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,7 +18,7 @@ jobs:
     name: Release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           persist-credentials: false